In contrast to the loss of validation accuracy incurred by DP-SGD defenses, the defenses via data augmentation (lower rows in Table REF , blue dots in Figure REF ) lose almost no validation accuracy. Nonetheless, they reduce poison success by, for example, up to \(60\%\)  in the case of MaxUp based on four cutouts. This improvement supports the conclusion of [1]} that MaxUp implicitly imposes a gradient penalty, thus smoothing decision boundaries. Also notable is that for this case of optimization-based poisoning attacks, mixup seems to be the optimal data augmentation among those tried which do not degrade validation accuracy. We conjecture that this is due to the implicit linearity enforced between data points by mixup optimization, which makes it harder for the poisoning scheme to successfully generate outliers. We can even further increase the defensive capabilities of mixup by considering a four-fold mixture of images instead of the two-fold mixtures discussed in [2]}. This defense is even stronger than vanilla mixup in both cases, but the four-fold mixtures of images leads to data modifications so stark that they negatively influence validation accuracy.
